Privacy Policy

Last updated: 15 August 2026

Sumzy helps groups of friends split shared expenses and keep every balance honest. We collect only what the app needs to do that. We never sell your data and never use it for third-party advertising.

Who we are

Sumzy ("Sumzy", "we", "us") provides the Sumzy mobile app for iOS and Android and the backend that powers it. The app communicates only with our own servers over an encrypted connection. If you have any question about this policy or your data, contact us at privacy@sumzy.co.

What we collect and why

We collect the following, and use it only to provide the app's features ("App Functionality"):

• Email address — your account identifier, used for passwordless sign-in (a one-time code), invitations, and account-related messages.
• Name — the display name you choose, shown to the people you share groups and expenses with.
• User ID — an internal account identifier we issue so your data and shared history stay consistent.
• Expense and balance data — the amounts, splits, group names, expense descriptions, and balances you enter. This is the core shared-expense information the app exists to track. It is not payment-card data: Sumzy does not process card numbers and does not move money.
• Language preference — the locale your app is set to, so that the emails and notifications we send you are in the same language.
• Crash diagnostics (optional, off by default) — if crash reporting is enabled, limited technical diagnostics are sent to help us fix bugs. See "Crash reporting" below.

To be explicit about what we do not collect or do:

• No passwords — sign-in is a one-time email code, Sign in with Apple, or Google Sign-In. There is no password anywhere in Sumzy.
• No phone numbers.
• No location data and no access to your contacts.
• No advertising. No ads, no third-party advertising or analytics trackers, and no ad SDKs. We do not track you across other apps or websites.
• We never sell your personal data.

How we use your data

We use the data above solely to run the service: to authenticate you, create and display your groups and expenses, calculate balances and settle-ups, send account and invitation messages, and keep the app working and secure. We do not use your data for advertising or profiling, and we do not share it with anyone except the limited service providers described under "Service providers".

Legal basis and your rights (LGPD & GDPR)

Sumzy is built to respect Brazil's LGPD and the EU/UK GDPR from day one. Where those laws apply, we process your data on the basis of performing our contract with you (providing the app), our legitimate interest in keeping the service secure and reliable, and your consent for anything optional (such as crash reporting).

You have the right to:

• Access the personal data we hold about you.
• Export a copy of your data — write to us and we will send it to you.
• Correct inaccurate data, such as your name.
• Delete your account — see "Data retention and deletion".

You can delete your account directly in the app (Account → Delete account). For access, export or correction requests, write to privacy@sumzy.co and we will respond within the period the applicable law allows.

Data retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time from Account → Delete account permanently, or by contacting us. For your protection, deletion is re-verified with a fresh one-time code sent to your email.

Because expenses are shared, deletion anonymizes your account rather than removing shared records that other people still rely on:

• Your name, email address, and avatar are erased.
• Your internal user ID is retained in anonymized form so that the balances and expense history of the other members in your groups remain correct. Those records no longer identify you.

If you want a copy of your data, request it before deleting — deletion is irreversible. Full details are on the account deletion page.

Crash reporting

To improve stability we may use Sentry for crash and error reporting. This is optional and off by default. When enabled, sensitive information — your email, authentication tokens, and request bodies — is scrubbed before anything is sent, and reports are associated only with an opaque account identifier, not with your name or email.

Data security

All traffic between the app and our servers is encrypted in transit over HTTPS. The app talks only to Sumzy's own backend. Authentication tokens are stored in the device's secure storage (iOS Keychain / Android Keystore), never in plain storage and never logged.

Subscriptions and payments

Sumzy Pro, when offered, is sold as an in-app subscription through the Google Play Store or the Apple App Store. Those stores are the merchant of record: they process the payment, and Sumzy never sees or stores your card details. We use RevenueCat to validate the store's purchase receipt and to tell our backend whether your account is entitled to Pro. RevenueCat receives an opaque account identifier and the store's own purchase data — not your name, your email, or your expenses. Cancelling or changing a subscription is done in your Google Play or Apple account settings; Sumzy cannot do it for you.

Service providers

We rely on a small number of infrastructure providers strictly to operate the service — cloud hosting and storage, and a transactional email provider to deliver your sign-in and account emails. Crash diagnostics, when enabled, are processed by Sentry. None of these are advertising networks, and none receive your data for their own marketing purposes.

International data transfers

Sumzy serves users in Brazil, and internationally. Your data may be processed and stored on servers located outside your country of residence, including by the service providers listed above. Where required by LGPD or GDPR, we rely on appropriate safeguards for such transfers.

Children

Sumzy is a general-audience product for managing shared expenses and is not directed at children. We do not knowingly collect personal data from children under the age of 13 (or the minimum age required by your local law). If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product evolves. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.

Contact

Questions or requests about your data? Email privacy@sumzy.co. For general help, see our support page.